Who Is the Merchant of Record in a Telehealth-Pharmacy Business Model?

The telehealth pharmacy merchant of record is generally the entity clearly identified as selling the particular service or product charged to the patient. No reviewed federal rule assigns this role universally; the contracts, disclosures, funds flow, refunds, disputes, applicable state law, and acquirer review must fit together.

Telehealth pharmacy merchant of record at a glance

Who is the merchant of record in a telehealth-pharmacy business?

The merchant of record should normally be the entity that contracts with the patient for the charged item, presents the seller and price clearly, and accepts responsibility for refunds, cancellations, complaints, and chargebacks. Those factors help identify the seller, but receipt of proceeds is a separate documented funds-flow question—not a defining requirement by itself.

An authorized agent, billing service, or other service provider may process or receive funds only when its contracts, disclosures, legal authority, data practices, and acquirer approval support that role. The entity operating the website or software is not automatically the seller.

A medical group, pharmacy, management company, and platform can participate in one patient journey without becoming one seller. The business should identify what the patient is buying, which entity promises it, which entity appears at checkout and on the statement, who issues refunds, and how money moves between the parties. This is an operational, contractual, payment-network, tax, and state-law determination requiring qualified review—not a universal federal telehealth designation.

Can a management company be the merchant of record for healthcare?

A management company may be the charging entity in some structures, but it is not automatically the principal seller because it owns a website, call center, software, or payment account. If it presents the offer, sets or controls pricing, manages the customer relationship, receives or directs funds, and handles refunds, an acquirer may view it as the principal seller rather than merely a technology vendor.

That structure must not imply that the management company is the licensed clinician or pharmacy when independent organizations perform those roles. Counsel should review agency authority, professional-entity and pharmacy rules, fee-splitting concerns, consumer disclosures, and state-specific telehealth requirements. A management company billing for another entity should ensure the checkout language, receipt, contract, refund obligation, and funds flow support the role claimed.

Should the medical group or pharmacy process the patient’s payment?

Each entity should generally charge for the service or product it clearly sells and is authorized to provide, unless counsel and the acquirer approve another documented structure. A medical group may charge for a professional telehealth consultation, while a pharmacy may separately charge for prescription fulfillment and dispensing.

A pharmacy charging for a combined offering does not automatically authorize it to bill for clinical services provided by an independent medical group. Likewise, a management company collecting money for prescription products requires review of its authority, contracts, disclosures, and state requirements. Separate charges can make receipts, statement descriptors, refunds, support, and disputes easier to explain, but no universal federal rule requires that model.

What does a processor need to underwrite a telehealth pharmacy company?

A processor or acquiring bank will need a coherent explanation of the legal entity, customer offer, regulated participants, funds flow, data handling, and post-sale responsibilities. Prepare:

• applicant entity, owners, website, checkout page, receipt, and statement descriptor;
• whether each charge is for clinical care, a prescription product, a membership, a management service, or a bundle;
• medical-group, clinician, pharmacy, platform, and management-company relationships;
• pricing, cancellation, refunds, fulfillment complaints, and chargeback procedures;
• recurring-billing disclosure and consent records;
• related entities routing sales through one account; and
• whether the applicant acts as principal, agent, marketplace, billing service, or payment facilitator.

A mismatch between the applicant, checkout seller, descriptor, service provider, and funds recipient can create underwriting questions and make authorization harder to demonstrate. The reviewed sources do not verify processor fees, reserve amounts, card-network thresholds, or approval timelines. Obtain those terms directly from the applicable processor or acquirer.

For preparation, review telehealth merchant account underwriting documents and how underwriters evaluate a telehealth website.

How do HIPAA and payment processing affect the decision?

HIPAA does not determine the merchant of record. HHS states that HIPAA applies to covered entities and business associates according to their roles and activities. Healthcare providers, including pharmacies, may be covered entities when they transmit health information electronically in connection with a transaction for which HHS has adopted a standard.

A business associate agreement is generally required when a business associate performs services for a covered entity involving protected health information. The HIPAA Privacy Rule, Security Rule, and Breach Notification Rule address permitted uses, safeguards, and notices after breaches of unsecured PHI. HHS also explains that a financial institution conducting normal payment transactions is not performing a business-associate function merely by processing those transactions. That does not resolve whether a platform or management company is a business associate when it performs billing, administration, or data processing involving PHI.

The FTC Health Breach Notification Rule, 16 C.F.R. Part 318, may apply to vendors of personal health records and related entities outside HIPAA. The FTC’s 2024 amendments became effective July 29, 2024. For breaches involving 500 or more people, the FTC stated that notice to the FTC is due at the same time as consumer notice, without unreasonable delay and no later than 60 calendar days after discovery.

What recurring-billing rules apply to the charging entity?

Under the Restore Online Shoppers’ Confidence Act, online sellers using negative-option programs must clearly and conspicuously disclose material terms before obtaining billing information, obtain express informed consent, and provide a simple way to stop recurring charges. The FTC’s 2024 amendments to its Negative Option Rule, 16 C.F.R. Part 425, would have added more, but the U.S. Court of Appeals for the Eighth Circuit vacated them on July 8, 2025.

The seller and charging entity should therefore control or reliably document the recurring-billing disclosure, consent record, cancellation workflow, refund policy, billing descriptor, and authorization records. The FTC published the rule on November 15, 2024, and stated that most provisions would become effective 180 days after Federal Register publication. The approved research does not independently resolve later litigation, stays, amendments, or enforcement developments, so confirm current status with counsel. State auto-renewal requirements may also be stricter.

What should the business do before choosing the merchant of record?

1. 1List each charge. Identify a consultation, prescription product, membership, management service, bundle, or separate item.
2. 2Identify the contracting party. State which entity signs the patient agreement and is responsible for each promise.
3. 3Capture the customer experience. Save checkout, consent, receipt, cancellation, refund, confirmation, and descriptor content.
4. 4Map the funds flow. Identify who submits the charge, receives funds, pays providers, issues refunds, and absorbs disputes.
5. 5Document regulated roles. Record clinical, dispensing, fulfillment, patient-support, and PHI-access responsibilities.
6. 6Obtain review. Have counsel assess state medical-practice, pharmacy, fee-splitting, telehealth, ownership, and consumer-renewal issues.
7. 7Submit the complete model. Ask the processor and acquirer to confirm approved entities, URLs, descriptors, transaction types, dispute procedures, reserves, and restrictions in writing.

Questions to ask the processor

• Which legal entity should apply for each charge type?
• Have you approved the medical-group, pharmacy, management-company, and platform relationships as described?
• What entity, descriptor, and business name will appear to the patient?
• What documents verify clinical services, pharmacy fulfillment, recurring billing, and funds flow?
• What refund, cancellation, chargeback, reserve, hold, and release terms apply?
• Do any URLs, transaction categories, products, or related-entity flows require separate approval?

Explore how MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch.

Is the merchant of record responsible for health claims and reviews?

The seller should know who controls claims, testimonials, influencer compensation, and patient-review campaigns. The FTC’s Endorsement Guides, 16 C.F.R. Part 255, require truthful, nonmisleading endorsements and disclosure of material connections. FTC health guidance states that health-related claims generally require competent and reliable scientific evidence. The Consumer Reviews and Testimonials Rule, 16 C.F.R. Part 465, addresses deceptive practices involving fake or false reviews and testimonials.

How does MDLaunchr fit into this decision?

MDLaunchr is the brand behind WhiteLabelClinic.com, one platform in the white-label telehealth infrastructure category. It is not a treating medical group, pharmacy, law firm, regulator, processor, or guarantor of approval. MDLaunchr helps qualified businesses evaluate and coordinate technology, operational, compliance, clinical-network, and fulfillment relationships. The merchant-of-record structure still requires qualified legal, clinical, pharmacy, privacy, and payments review.

Disclaimer

This article is for general educational and business-planning purposes only. It is not legal, regulatory, payment-processor, medical, pharmacy, or privacy advice, and it does not determine that a business structure is permitted or approved. Laws, licensing requirements, processor policies, and enforcement positions can change. Consult qualified counsel and appropriate clinical, pharmacy, privacy, and payments professionals before launching or changing a telehealth-pharmacy model.